agentsteal has reported some vulnerabilities in LetterGrade, which can be exploited by malicious people to conduct cross-site scripting attacks or by malicious users to conduct script-insertion attacks.

1) Input passed as e.g. a student's email address is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed.

2) Input passed to the "year" parameter in genbrws/Student/cal_month.php3 is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Reportedly, other parameters in the calendar are also affected.

A full path disclosure and user enumeration weakness have also been reported.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
agentsteal

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers